{
  "@id": "urn:uuid:5bb073c0-98e6-4059-8edf-4b3675d53476",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T11:39:00.133278+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 affects version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      },
      "action_statement": "Vulnerability CVE-2021-37137 affects version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:25:00.081871+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 does not affect version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks. not_affected \u2014 The target repository (Netty 4.1.128.Final) is NOT AFFECTED by CVE-2024-47535. The vulnerability\u2014unbounded file reads causing OutOfMemoryError\u2014was fixed by the upstream Netty project via commit fbf7a704a82e7449b48bd0bbb679f5661c6d61a3 (dated 2024-11-12) which introduced BoundedInputStream to limit file read sizes. This fix was already present in the upstream 4.1.128.Final release when TuxCare o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.128.Final) is NOT AFFECTED by CVE-2024-47535. The vulnerability\u2014unbounded file reads causing OutOfMemoryError\u2014was fixed by the upstream Netty project via commit fbf7a704a82e7449b48bd0bbb679f5661c6d61a3 (dated 2024-11-12) which introduced BoundedInputStream to limit file read sizes. This fix was already present in the upstream 4.1.128.Final release when TuxCare o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:39:00.133278+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks. not_affected \u2014 CVE-2025-25193 affects BoundedInputStream's handling of null-bytes (0x00) which were not counted toward the input limit due to checking `if (b > 0)` instead of `if (b != -1)`. This allowed attackers to cause DoS via unbounded memory consumption. The target repository (Netty 4.1.128.Final) is NOT AFFECTED because the fix was already present in the upstream release 4.1.128.Final before TuxCare on...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-25193 affects BoundedInputStream's handling of null-bytes (0x00) which were not counted toward the input limit due to checking `if (b > 0)` instead of `if (b != -1)`. This allowed attackers to cause DoS via unbounded memory consumption. The target repository (Netty 4.1.128.Final) is NOT AFFECTED because the fix was already present in the upstream release 4.1.128.Final before TuxCare on..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:21:00.129554+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 does not affect version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks. not_affected \u2014 The upstream Netty project fixed CVE-2025-58057 in commit 34894ac73b (September 2025) by modifying BrotliDecoder and other decompressing decoders to forward decompressed buffers incrementally instead of accumulating them in a list. This fix shipped in Netty version 4.1.128.Final. When TuxCare onboarded 4.1.128.Final in October 2026, the fix was already present in the upstream release. The curre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "impact_statement": "not_affected \u2014 The upstream Netty project fixed CVE-2025-58057 in commit 34894ac73b (September 2025) by modifying BrotliDecoder and other decompressing decoders to forward decompressed buffers incrementally instead of accumulating them in a list. This fix shipped in Netty version 4.1.128.Final. When TuxCare onboarded 4.1.128.Final in October 2026, the fix was already present in the upstream release. The curre..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:53:07.426702+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 is fixed in version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:51:48.115053+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:51:48.115053+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.128.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:51:48.115053+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.128.Final-tuxcare.1 of io.netty:netty-codec-socks."
    }
  ]
}